map.json

{
   "Potential Shadow File Read via Command Line Utilities": {
      "artifacts": [
         {
            "dataType": "domain",
            "data": "host.hostname",
            "message": "localhost"
         },
         {
            "dataType": "ip",
            "data": "process.entry_leader.entry_meta.source.ip",
            "tags": [
               "ssh",
               "client"
            ]
         }
      ],
      "custom_fields": {
         "host": "host.hostname",
         "user": "user.name",
         "command-line": "process.command_line",
         "process": "process.executable",
         "pid": "process.pid",
         "parent-process": "process.parent.executable",
         "ppid": "process.parent.pid",
         "pwd": "process.working_directory"
      }
   }
}